If I send a fax from an unsecure endpoint to a secure endpoint, is the data secure?

Question

I am very technical, but I do not know much about fax. I was told to send a fax to somebody with some very private information, and not to worry because they had a secure fax line.

That's all well and good, but I do not have a secure fax line. Does this matter? Or am I in the right not wanting to send this data to them via fax.

Answer 1

I wouldn't much care if the line were secure, I'd want the connection to be secure.

Consider the possible ways your data could be intercepted:

• If you send from a fax machine at your office, the line could be tapped in the corporate wiring cabinet, or anywhere between the machine and the cabinet.
• If you send from home, the line could be tapped at the network interface.
• The line could be tapped between the network interface and the CO.
• A rogue phone company employee could be listening.
• A government could be listening ("lawful intercept").
• The same set of taps could be in place between the CO and the receiver.
• When the fax rolls off the receiver's machine, if the machine is not in a physically secure location (e.g. a locked office), then a casual snooper might see your info.
• If the fax is stored electronically instead of printed directly onto paper, it could be "stolen" from the electronic storage system.

So the answer is no, the data is not secure. You need to be able to establish an encrypted connection to the receiver, and (if it is very sensitive) you want to understand how they will be handling the data once it has been received.

Answer 2

A chain is only as strong as its weakest link

Your fax communication is not secure if one of the participating hops is not secure.

If your fax machine does not support same encryption that somebody's fax machine then fax will go insecure (clear text) or will be blocked, depending on settings.

Answer 3

It's never a good idea to send private information in a fax, even though it seems like every single company requires it at some point. Fax communication cannot be secured without specialized hardware or software, so you cannot send from an insecure fax line to a "secure" line in any way that is secure end-to-end.

Whether or not this matters really depends on the information being sent. It also depends on how the fax is managed on the receiving end... does the fax just get stacked onto a pile of others that anyone can look through or what?

Answer 4

There's no such thing as a "secure line". Whoever fed you that line has watched too many movies.

Sending faxes is not a good strategy if you need strong security. Anyone who can eavesdrop on any of the phone lines involved, can eavesdrop on the contents of the fax. But a perhaps even bigger risk is that you don't know who is on the other end, how the fax is being handled, or whether your fax is going to the right place. It would be easy to screw up and (without realizing it) inadvertently send your fax to the wrong number. You also don't know what digital copies of the data may be inadvertently retained on your fax machine or their fax machine, or who may have access to that fax machine, or what may happen to it if it gets sold.

If it's "very private" information, I don't know if I'd use fax. I'd have to know more about what the information is or how severe the consequences are for inadvertent disclosure, and who might have an interest in tapping your phones -- but faxes have some inherent security limitations that are difficult to counter.